- C 94.3%
- Makefile 5.7%
| .gitignore | Gave more specific name to bpftrace script | |
| demo.gif | Renovated README.md | |
| event.c | Added event_mpsc_clean | |
| event.h | Added event_mpsc_clean | |
| fcdl-ext4.bpftrace | Cleared map at the bpftrace end | |
| LICENSE | Add LICENSE | |
| main.c | Added renameat2 kretprobe | |
| Makefile | Added event and an mpsc event queue | |
| README.md | Fixed license link | |
Overview
FCDL — File Creation/Deletion Logger. A Linux kernel module that intercepts the system calls and outputs created or deleted files from a character device.
This document is a short description of my module, focused on how to build and use it. For history of development and architectural details, see my website.
Demonstration
On left pane: commands being entered in the real time.
On right pane: launched fcdl-cli.
The following software was used:
Building and installing
Building is done, like with all kernel modules, through Kbuild:
make # put the module in this directory
make install # probably requires root privilege
After building, an fcdlogger.ko will be available at this directory for you
to insmod and experiment. Have fun!
KBuilding was tested on Linux kernel 6.15.2, although it should be supported on many other versions of Linux kernel as well.
Usage
After you do one of the following commands:
insmod fcdlogger.ko # if built in this directory
modprobe fcdlogger # if installed
A character device /dev/fcdl appears.
Only one process can read it, and by default it has UID = GID = 0, mode = 0600.
There are 2 ways it can be read:
- with command line utility fcdl-cli, which parses binary output and formats it to the user;
- reading manually.
We'll focus on manual reading, on the basics.
For one read system call with count >= 50041 , one filesystem event gets
returned to the userspace buffer, with the following contents:
-
8 bytes — time of event, in seconds since Unix epoch;
-
1 byte — type of event:
- 0
- File was created.
- 1
- File was deleted.
-
Remaining bytes — absolute2 path to the file.
Practical application
There is none.
If you really need a robust functionality for watching the filesystem events, use inotify. My module is just an experiment and a way to learn the Linux kernel programming and share the experience with others. Also, it's not very tested and probably never will be.